twotalesanimation
08b6e58b8e
Deploy Vault CMS / deploy (push) Successful in 2m23s
- Upgrade next 16.0.3 -> 16.3.5 and react/react-dom 19.2.0 -> 19.3.0 (CVE-2025-55182 / CVE-2025-66478 unauthenticated RCE), next-auth -> 4.24.15 - Require admin role on /api/users, /api/courses and /api/enrollments, which were unauthenticated - Replace ALLOWED_ADMINS checks that allowed any signed-in user when the variable was empty with the role-based requireAdmin - Sanitize upload filenames, restrict thumbnail extensions, store edited thumbnails in UPLOADS_DIR, tighten traversal checks in file routes - Dockerfile: Node 22, pinned pnpm, non-root user, critical audit gate - Compose: read-only rootfs, dropped caps, no-new-privileges, Postgres password from env - Exclude .env from Docker build context; add security headers - Deploy with git reset --hard instead of git pull - Remove stale package-lock.json Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
41 lines
528 B
Plaintext
41 lines
528 B
Plaintext
.git
|
|
.gitignore
|
|
node_modules
|
|
.next
|
|
# Never bake secrets into image layers; they are passed in at runtime
|
|
.env
|
|
.env.*
|
|
.gitea
|
|
*.tsbuildinfo
|
|
.DS_Store
|
|
*.log
|
|
npm-debug.log*
|
|
yarn-debug.log*
|
|
yarn-error.log*
|
|
.pnpm-debug.log*
|
|
.turbo
|
|
.swc
|
|
.vscode
|
|
.idea
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
.cache
|
|
coverage
|
|
dist
|
|
build
|
|
out
|
|
.env.example
|
|
README.md
|
|
LICENSE
|
|
.editorconfig
|
|
.prettierrc
|
|
.eslintrc*
|
|
.gitattributes
|
|
public/videos
|
|
public/thumbnails
|
|
# Note: public/uploads is no longer used; uploads are stored in UPLOADS_DIR (/uploads)
|
|
uploads
|
|
.turbopack
|
|
.turbopack-cache
|